envoy-gateway: enable CrowdSec ext_authz on the public gateway

Wires crowdsec/gateway-public-securitypolicy.yaml into the kustomization now
that LAPI, AppSec and the bouncer are all healthy and the envoy bouncer is
registered with LAPI.

Covers every listener on gateway-public rather than just one app, since EG
v1.3.2 rejects targetRefs.sectionName on SecurityPolicy. gateway-internal is a
separate Gateway and is untouched, so LAN access is unaffected. failOpen is
true, so a bouncer outage lets traffic through instead of denying it.

infra/envoy-gateway/kustomization.yaml

@@ -6,10 +6,9 @@ resources:
   - gateway.yaml
   - gateway-public.yaml
 
-  # CrowdSec (public gateway hardening) — HELD pending enforcement-scope decision
-  # (EG v1.3.2 SecurityPolicy does not support sectionName; see it-tools-securitypolicy.yaml)
-  # - crowdsec/envoyproxy-public.yaml
-  # - crowdsec/it-tools-securitypolicy.yaml
+  # CrowdSec ext_authz on the whole public gateway (sectionName scoping is
+  # unsupported on EG v1.3.2; envoyproxy-public.yaml is not needed, see its header)
+  - crowdsec/gateway-public-securitypolicy.yaml
 
   # Policies
   - pelican/pelican-wings-clienttrafficpolicy.yaml